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SUMMARY 


To assess the feasibility of a digital fly-by-wire system , the mechanical flight 
-control system of an F-8C airplane was replaced with a digital primary system and 
an analog backup system . The Apollo computer was used as the heart of the primary 
system. This paper discusses the experience gained during the design and develop- 
ment of the system and relates it to active control systems that are anticipated for 
future civil transport applications . 


INTRODUCTION 


A major deterrent to the application of active controls to transport aircraft has 
been a lack of experience in designing highly reliable flight control augmentation 
systems and verifying them in flight . Digital fly -by-wire technology has the 
potential for providing the necessary reliability while still offering design flexibility. 
To assess the feasibility of a digital fly -by-wire system , the NASA Flight Research 
Center conducted a flight research program in which the mechanical flight control 
system of an F-8C airplane was replaced with a digital primary system and an 
electrical analog backup system . 

This paper describes the fly-by-wire system and the design and development of 
the digital primary system . The system and the design procedures are assessed in 
light of similar applications being contemplated for future transport aircraft . 

The paper was written in conjunction with references 1 to 3 , which discuss the 
backup control system , software management , and results from the flight tests . 
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SYMBOLS 


K 

KAZ 

KG 

KP 

KQ 

KR 

s 

T 



proportionality constant 

normal acceleration feedback gain to stabilizer , deg/g 
stick or rudder pedal gearing constant , deg/m 
roll rate feedback gain to ailerons, deg/deg/ sec 
pitch rate feedback gain to stabilizer , deg/deg/ sec 
yaw rate feedback gain to rudder, deg/deg/sec 

pitch rate at k ul sample , deg/ sec 

Laplace transform variable 
sample period , sec 

sT 

complex variable, e 

■fVi 

pitch angle at k in sample 

TEST AIRPLANE 


An F-8C airplane (fig. 1) was selected for use in flight testing a digital fly -by- 
wire system. Several characteristics of the airplane made it suitable for this test 
program . The handling qualities without control augmentation were acceptable for 
emergency operation, thus backup control could be provided through a relatively 
simple system. In addition, the airplane had enough space for the system’s compo- 
nents, and the capacity of the hydraulic systems was adequate. 

Some features of the F-8C airframe had an impact on the fly-by-wire system 
design. The variable-incidence wing moves up 8° for low- speed flight. This 
rotates the fuselage nose down relative to the free airstream, improving the pilot’s 
visibility during the approach. Several functions within the flight control system 
are programed as a function of wing position. For example, the horizontal stabilizer 
is driven 5° leading edge up when the wing is raised. 

The F-8C airplane does not have independent flap surfaces, so the ailerons are 
driven collectively to serve as flaps through a mechanical linkage independent of 
the primary control system . For this program the linkage was disconnected and the 
ailerons were driven to the drooped flap position through the fly-by-wire system . 
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The original F-8C flight control system had a direct linkage in pitch (no augmen- 
tation) , and roll and yaw stability augmentation systems (S AS) (figs. 2(a) and 2(b)) . 
The yaw SAS included an aileron-to-rudder interconnect with a gain programed as 
a function of stabilizer position . 


DATA ACQUISITION SYSTEM 


A standard NASA pulse code modulation (PCM) system was installed to record 
airplane motion , pilot input , and fly-by-wire system parameters external to the 
computer . Seventy-seven channels of 9-bit data were recorded on an onboard tape 
and telemetered to a ground station for real-time monitoring. Eight of the channels 
were digital words indicating the state of 57 discrete values from the fly-by-wire 
system. Although excellent for automated data reduction, the PCM system proved 
to be unsuitable for investigating the effects of analog-to-digital and digital-to- analog 
quantization. The resolution of the PCM system was on the same order as that of the 
digital control system quantization , which made it difficult to isolate the effects of the 
control system quantization. 

Internal digital computer parameters were recorded on the onboard PCM tape 
recorder . One-hundred-word pairs were strobed out every 2 seconds and recorded 
for postflight analysis . The word lists were resident in the software onboard the 
airplane and could be reprogramed during the flight tests. This recording system 
was used primarily to determine the gross status of the computed parameters within 
the flight control system; the strobe rate was inadequate for tracing individual 
parameters each control computational cycle . 


IRON BIRD SIMULATOR 


An iron bird simulator played an important role in the development of the fly- 
by-wire system. The simulator consisted of another F-8C airplane, in which all the 
digital fly-by-wire flight control hardware was installed , tied in with a hybrid 
computer and appropriate interface equipment (fig . 3) . The digital fly-by-wire 
hardware was flight qualified and served as spares for the flight vehicle . The F-8C 
aerodynamics and bending modes were modeled by using the digital portion of the 
hybrid computer for the aerodynamics and the analog portion for the bending modes . 


FLY-BY-WIRE SYSTEM 


The fly-by- wire system had a digital primary control system and an electrical 
analog backup control system . Components of the fly-by-wire system are shown in 
figure 4 , and the location of the components in the F-8C airplane is illustrated in 
figure 5. 

A simplex digital primary system and a triplex electrical analog backup system 
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provided enough reliability that the mechanical system could be completely removed . 
The digital primary system consisted of a computer, inertial measurement unit, 
coupling data unit , and display and keyboard , all taken from the Apollo guidance 
and navigation system . Reference 4 provides details on this equipment relative to 
the Apollo application , The triplex backup control system consisted of only surface 
position command electronics . Specially designed electrohydraulic secondary 
actuators interfaced the primary and backup electronic commands with the conven- 
tional F-8C control surface power actuators. 

Components of the fly -by-wire system were part of the primary or backup 
system and , in some instances , were shared between the two systems . Individual 
components are described in the following sections according to function . 


Computational 

The Apollo computer performed all flight control computations in the primary 
control system . Characteristics of this computer are summarized in the following 
tabulation: 


Read-only memory 
Scratch pad memory 
Word length . . . . 
Number system . . . 
Memory cycle time 
Computation time — 

Add 

Multiply . . , . . 
Divide ...... 


86 , 864 words 
2 , 048 words 

14 bits plus sign and parity 
Fixed point, ones complement 

11 . 7 microseconds 


23.4 microseconds 

46 . 8 microseconds 

81.9 microseconds 


Although slow by today's standards , the computer could perform all flight control 
functions within 30 milliseconds . Flight control laws for the F-8C airplane were 
programed for the computer's hardwired memory and could not be changed after the 
memory was manufactured . However , flexibility was achieved by placing feedback 
gains , logic flags , digital filter coefficients , and other gain variables in the 
computer's scratch pad memory ; 105 of these variables associated with the flight 
control system could be changed . 

Control laws for the backup system were mechanized in triplex control electronic 
boxes , which can be considered to be special-purpose analog computers . Each 
electronic box contained 67 operational amplifiers . Requirements for high reliability 
in the flight environment dictated the use of ruggedized packaging and hardwired 
circuits . Consequently , flexibility for changing control laws was limited to gain 
and nonlinear constant changes; even these changes required replacement of hard- 
wired resistors and diodes . Although the control system is considered to be an 
analog system , more than half of each electronic box containing individual channels 
of the analog electronics was devoted to logic elements , such as comparators between 
the redundant channels . 
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Pilot Interface 


Vehicle control and trim inputs,— The center stick was the primary means of 
control for both the primary and the backup systems . It was connected to the basic 
F-8C mechanical feel system. Disconnecting the mechanical links to the control 
surface caused undesirable looseness in the lateral stick , so a viscous damper was 
added . Stick position was sensed through two separate linear variable differential 
transformers (LVDT) in each axis . Each LVDT had triplex windings . Two of the 
windings from one LVDT in each axis were used by the primary system; the third 
winding was for instrumentation . The second LVDT provided triplex inputs to the 
backup control system. 

A minimum displacement , two-axis side stick was used as an alternate controller 
input to the backup system , This side stick was not part of the original fly -by -wire 
system; it was used only as a means of evaluating a "force type" side stick controller 
in an actual aircraft environment (ref. 1) . 

The rudder pedals provided inputs to both the primary and the backup systems. 
Similar to the center stick , they were connected to the F-8C mechanical feel system 
and used LVDT's for sensing rudder pedal position . 

Trim commands for primary pitch and roll were made through a two-axis beeper 
switch on the center stick. Backup trim inputs in all three axes were made through 
separate spring-loaded toggle switches on the pilot's left-hand console. These 
toggle switches were also used to provide primary yaw trim and primary pitch and 
roll trim inputs if the center stick trim switch failed . When the side stick was being 
used , trimming was accomplished through a beeper switch on the side stick . 

Fly-by-wire functional control.— Figure 6 shows the mode and power panel, 
which was the pilot’s means of communicating with the primary system . The pilot 
was able to choose between several different control system modes simply by 
depressing the appropriate button . Additionally , he was able to change system gains 
according to the logic loaded in the software before the flight. Several primary 
system failure status lights were located across the top of the panel, and power 
switches and power status lights were located across the bottom . Individual axes 
could be transferred to backup through the backup control system (BCS) switches. 
The pilot could also transfer all axes to backup simultaneously by using a "paddle 
switch" on the center stick . 

A servo engage panel on the left-hand console permitted the pilot to selectively 
engage or disengage each channel of each servo actuator . The panel provided 
control over both the backup and the primary systems . The status of the actuation 
system and the backup electronics was displayed on this panel . 


Motion Sensing and Interface 

Another component from the Apollo guidance and navigation system was the 
inertial measurement unit . Although angular body rates and linear accelerations 
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were not measured directly in the Apollo application, the substitution of aircraft 
gyros and accelerometers for the fly-by-wire tests would have required a major 
system modification and would have sacrificed the integrity of the total Apollo 
system. An alternate approach was adopted: Body rates and linear accelerations 
were computed from the gimbal angles and the digital incremental velocity vector 
information the inertial measurement unit provided to the Apollo computer for use in 
the primary system . 

A coupling data unit provided the interface between the inertial measurement 
unit and the Apollo computer in the Apollo guidance system and provided the same 
function for the primary system in the F-8C application. The angular resolution was 
0.011°; however, the rate resolution was of more importance and was nonlinear with 
gimbal angle rate . Body angular rate estimation was directly related to gimbal angle 
rate resolution, Gimbal rate resolution was ±0.183 deg/sec for rates less than 
4.4 deg/sec, and ±2.74 deg/sec for rates between 4.4 deg/ sec and 70 deg/sec. The 
error was manifested as a random noise band of 2.74 deg/sec peak to peak for rates 
greater than 4.4 deg/sec . Acceleration was sensed by using pulse integrating 
pendulous accelerometers . The quantization level for the normal acceleration sig- 
nals was 0 . 2g . 

The coupling data unit contained several digital-to-analog converter channels , 
which made it possible to send the necessary primary system commands to the 
control surfaces . To protect against undetected failures between the computer and 
the surface actuators, dual signals were generated in each axis, beginning with 
dualized commands to dual digital-to-analog converters in the coupling data unit in 
each axis . The control surface drive signals were quantized to ±384 levels , which 
is somewhat less than a full 9-bit word. 


Control Surface Actuation 

Similar actuation systems were used in each axis, Each actuation system had a 
secondary actuator and a power actuator. Separate sets of actuators were used for 
the left and right horizontal stabilizers and ailerons . A single set of actuators was 
used for the rudder . 

The hydraulic power actuators from the basic F-8C airplane were used without 
modification . Electrohydraulic secondary actuators were installed to drive the 
metering valves of each of the five power actuators . The secondary actuators 
acted as three-chamber force summing devices when driven from the backup system . 
The primary system drove the secondary actuators through active monitor servo 
valves . 

When the secondary actuators were driven through the primary system , they 
were stabilized through the active servo valve in the primary system electronics 
box. Analog 5-hertz low-pass filters were included in the primary system elec- 
tronics. When driven through the backup servo valves, the secondary actuators 
were stabilized in the backup system electronics packages , one for each of the three 
backup channels . 
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Reference 1 describes the actuation systems in more detail. 


Primary/Backup System Interface 

A functional diagram of the fly-by-wire system is shown in figure 7 . The 
Apollo computer received inputs from the pilot's stick together with aircraft motion 
information from the inertial measurement unit. Surface commands were computed 
according to the programed control laws . 

The two drive signals for each surface represented commands to the secondary 
actuator position loop , which was closed with analog stabilization electronics outside 
the Apollo computer , As shown in figure 7 , there was an active and a monitor servo 
path. If a failure occurred in either path, a hydraulic comparator would sense the 
differential pressure between the active and the monitor servo valve and transfer 
control to the backup control system . As long as the primary control system was 
operating normally , the backup control system would track the active channel by 
way of the synchronization network . Only the hydraulic pressure was bypassed at 
the secondary actuator , so that the backup system was ready to take over at any 
time . If a transfer to the backup system was requested , the bypass was removed 
and the synchronization network was disabled , resulting in immediate proportional 
control from the pilot's stick. In the backup mode, the active servo valve was 
blocked and the secondary actuator operated as a force summer for the three backup 
channels. The digital computer continued to operate, computing the control laws 
which gave the best estimate of what the backup system commanded. If a transfer 
to the primary control system was attempted , the transient was small as long as the 
computer was tracking the backup system . If the error was excessive between the 
primary control system and the backup control system , a cross-channel comparator 
prevented transfer to the primary control system . 


Fault Detection 

Although built-in fault detection was extremely important for both the primary 
and the backup systems, it was of particular importance in the primary system. 
Because the primary system was full authority as well as single channel, its 
responses could have been hazardous if failures were not handled properly. 
Therefore, it had to be established that no digital computer system hardware failure 
could cause a hardover or otherwise hazardous signal. Figure 8 shows the type of 
digital system failure detection used . The Apollo computer had an extensive and 
proved fault detection and reporting system which was built into the computer 
hardware (item 1 in the figure) . This system , modified slightly for application to 
the F-8C airplane, was the most significant portion of the failure detection system. 
Some of the types of failures detected were: 

Logic circuits — 

Parity failed 

Program entered loop and did not exit 

Program attempted to access unused read-only memory 

Program failed to check in occasionally 
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Analog circuits — 

Voltage went out of limits 

Oscillator failed 

Timing pulse generator failed 

Each of the failures caused a restart, that is, a hardware-forced transfer out of the 
control law program to a software routine which performed several clearing and 
initialization steps in an attempt to correct the cause of the restart before allowing 
control law computations to continue. For some restart conditions, a signal was 
issued which caused a transfer to the backup control system . 

The Apollo computer also monitored the performance of the inertial measurement 
unit (item 2 , fig. 8) . Written into the software were decisions either to transfer the 
system to the backup control system for serious failures or to select the direct mode 
in the primary system for situations such as an inertial measurement unit acceler- 
ometer failure, which would affect only certain augmented modes. 

Analysis of primary system failures showed the need for additional hardware 
failure detection circuitry (item 3 , fig 8) . The failure of certain channel outbits 
not monitored by the Apollo computer , in combination with normal pilot reactions , 
could have led to hazardous situations . Thesfe conditions first became apparent in 
piloted , closed-loop simulations using the iron bird simulator . The necessary hard- 
ware modifications were made and implemented in the system to circumvent these 
failure conditions or to cause a transfer to the backup control system when prevention 
was not possible. 

Built-in test equipment for the backup system and primary electronics was 
provided in the pilot’s side console. This self-test equipment could be activated 
only during preflight tests (ref . 1) . 


FLIGHT CONTROL SOFTWARE 


Software flexibility made it possible to investigate a multimode F-8 digital flight 
control system using hardware that was designed for an entirely different purpose — 
guidance and navigation in space . The structure of the primary system control laws , 
which were implemented through software , and the associated logic functions are 
described . 


Control Law Modes 

Control in each axis was provided in the control laws . The simplest form in 
each axis was the direct mode , illustrated in figure 9 . The control law structure 
and gain settings were selected to be as close as possible to those of the backup 
control system. The first level of augmentation was rate feedback in the pitch and 
roll axes . Figure 10 illustrates these SAS modes as they were during flight tests . 
In the yaw axis , an aileron -to -rudder interconnect was included in addition to the 
yaw rate feedback (fig. 11) . The most advanced type of control law was a blended 
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pitch rate and normal acceleration command augmentation mode , illustrated in 
figure 12. 

The sampled-data aspect of the digital fly-by-wire system significantly affected 
the implementation of the software. The pitch SAS mode, illustrated in figure 13, 
was representative of the other augmented modes . A multirate sampling system was 
used, with a major cycle sample time, T, of 30 milliseconds and a minor cycle 
sample time , 3T , of 90 milliseconds . Gimbal angles were transformed to body angles 
by using sines and cosines of gimbal angles updated once every minor cycle . A 
second-order rate estimator operating on these gimbal angles provided body rates , 
which were then filtered . General-purpose digital filters were programed so that 
different characteristics could be selected independently for each feedback parameter . 
Proper selection of the difference equation coefficients could provide a wide range 
of filter characteristics . A first-order prefilter , a dead band , and a parabolic 
nonlinear gradient were available to shape the pilot’s input. 


Logic Functions 


An important capability made possible through software was the integration of 
logic statements in the control law code. Logic statements, even though complex, 
were easily written into the software . Had the system been analog rather than 
digital, special-purpose hardware would have been necessary to perform the same 
logic functions . One mode logic function associated with the yaw axis is discussed 
in reference 5 . 

Another type of logic function was the software reasonability test which was 
applied to each surface command before it was sent to the digital-to-analog converter . 
If the new command differed from the previous command by more than a predeter- 
mined amount , the affected axis would have transferred to the direct mode . This 
down mode philosophy was based on the assumption that a reasonability limit would 
be exceeded because of generic failures in the augmentation control laws rather than 
because of a hardware failure which would have affected the direct mode as well. 

It was assumed that a hardware failure would have been detected by the built-in 
Apollo computer fault detection logic . 

Trim inputs were also tested for reasonability before the trim value was updated. 
If a combination of primary trim commands was sensed that corresponded to an 
impossible situation for an unfailed system , a failure was assumed , the primary trim 
was deactivated , and an auxiliary trim system was activated . A test for runaway 
trim was included which disabled trim updates if the trim command persisted for 
more than 3 seconds . 


DIGITAL FLY-BY-WIRE DESIGN 


Design Ground Rules 

Several ground rules were established in order to meet the objectives of the 
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program. First, the airplane was to fly from the first flight without mechanical 
reversion capability . This forced the designers to take the care necessary to 
establish as much confidence in the system , including the software , as would be 
required for future active control applications . Second, the primary digital system 
was to utilize the hardware from the Apollo guidance and navigation system . The 
system was to remain intact; only software changes were allowed . The primary 
reason for this requirement was to retain the system’s high degree of built-in 
integrity and reliability . A third basic design ground rule established early in the 
program was to make the pilot’s interface with the computer as simple as possible. 

As a result , the pilot was given control over flight control functions rather than a 
direct communication with the computer . All functional changes (for example , a 
mode change) desired by the pilot were to be made through single switch actions . 
This allowed the pilot to perform functional changes rapidly and eliminated the 
possibility of incorrect entry or improper addressing which could have had dire 
consequences close to the ground or at high dynamic pressure. The last ground 
rule was to provide handling qualities that would be judged satisfactory by the 
pilots. A criterion based on C* response to a step pitch stick command (ref . 6) 
was used as a guide during the design of the longitudinal control system . Military 
Specification MIL-F-8785B, level 1, was used during the lateral-directional control 
system design . 

v 

These ground rules had further implications . For example , the interface 
equipment associated with the Apollo hardware established limits on the flight 
envelope for satisfactory operation. The analog-to-digital converter used for pilot 
stick inputs had only 45 usable discrete levels between zero and full stick . In the 
pitch axis each discrete level resulted in a specific level of aircraft normal acceler- 
ation , depending on stick gearing and dynamic pressure . In this instance , the 
acceleration increment became objectionable to the pilot within the basic flight 
envelope . Thus a new flight envelope limit was established at the dynamic pressure 
at which the stick quantization effect was not objectionable. Because of the design 
characteristics of the inertial measurement unit, some additional restrictions were 
placed on the airplane’s maneuverability . These included a roll angular rate limit 
of 70 deg/ sec and a pitch attitude limit of 70°. 


Design Synthesis and Analysis 

The closed-loop primary system was synthesized and analyzed by using two 
methods . The first was an analog sample and hold simulation which was useful in 
the learning process in that it pointed out the more general aspects of the digital 
control problem. For example, the acceptable range of sample rate, 25 to 50 samples 
per second, was defined. The effect of the folding phenomenon of sampled-data 
systems on the structural mode frequencies and the influence of common nonlinearities 
were also studied in this design phase . The second method used a digital synthesis 
program which provided linear analysis as a cross check and a background for the 
sample and hold simulation. Basie control laws, compensation, and logic were 
established by using these two methods . A specification for the control law software 
was then formulated , thus providing the basis for coding the flight software. 
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Design Verification and Refinement 

With the delivery of portions of the flight hardware , including the Apollo 
computer and the coupling data unit, and early releases of flight software, design 
verification and refinement was started, A six-degree-of-freedom digital aerodynamic 
model of the F-8C airplane was used in conjunction with the flight hardware to form 
a partial hardware hybrid simulation . 

The first two analysis methods did not consider any pilot interface, but the 
partial hardware hybrid simulation included a lunar module hand controller with 
which the F-8C model could be crudely flown. Coarse input quantization, a problem 
of importance later , did not become evident in this simulation because it was 
completely masked by the characteristics of the hand controller . This is one of the 
major disadvantages of any simulation which does not include major hardware 
elements . 

Another important tool in the design verification and refinement was the batch 
process all-digital simulation. This simulation included the software being verified, 
an Apollo computer emulator , and a program representing the F-8C aerodynamics , 
all run on a large host computer. Powerful plotting routines made the internal 
computer parameters visible during each run. All the control system parameters 
were examined for reasonableness , particularly as they responded to mode and gain 
changes . One of the most useful plots was duty cycle versus run time . A typical 
variation of duty cycle during a maneuver is shown in figure 14 for a roll step . 
Because of some additional code for computation of stick nonlinearities when the 
stick was displaced from zero , additional computational time was required during 
this maneuver . This was reflected in an increase in the duty cycle, as shown in 
the figure . Other contributions to duty cycle were the interrupts from the motion 
sensors. The increase in roll rate produced a loss in available computation time 
roughly proportional to the roll rate . This loss of computation time effectively 
increased the duty cycle . 

The last step in the design verification used the iron bird simulator . One 
problem — the coarse quantization of the pilot’s stick inputs — was uncovered 
immediately . The problem became obvious once the hand controller was replaced 
with the actual center stick . The staircase shape of the computer output commands 
produced sharp responses at the secondary actuators which were unacceptable from 
the standpoint of mechanical motion and structural element excitation . Low-pass 
filtering of the computer output was undesirable because of its adverse effect on 
closed-loop performance. This suggested the use of a digital pilot prefilter that 
had not been anticipated in the control law specifications . The flight software had 
already been substantially verified , but fortunately the read-only memory had not 
yet been manufactured . The prefilter was quickly programed in software and the 
code was reverified . Consequently , there was essentially no effect on the overall 
schedule . This points out one of the significant advantages of a digital flight 
control system: Necessary changes can be made late in the design without affecting 
hardware procurement, packaging, or requalification. Although additional software 
verification will be required , it will not have the adverse effect on program sched- 
ules that is typical of a hardware redesign of an analog system . 

Looking back on the various design and analysis tools , it is apparent that they 
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complemented one another . Confidence in the system grew each time an independent 
simulation or analysis gave results comparable to those obtained previously. The 
importance of having the pilot in the loop with as much actual hardware as possible 
was demonstrated vividly . In terms of time spent on verifying the various aspects 
of the design , the largest proportion was devoted to systematically verifying each 
logic function and mode transfer and the effects of failures . Another time-consuming 
aspect was the refinement of stick gradients and nonlinearities near zero stick. A 
much smaller proportion of time was spent on closed-loop augmentation character- 
istics , probably because of the good agreement generally found between the results 
from sampled-data analysis methods and simulation results . 


RELATIONSHIP TO FUTURE APPLICATIONS 


The configurations of future fly-by-wire systems will probably be strongly 
dependent on the specific missions for which they are designed . As such , each 
system will be unique in some respects , but will have a large degree of commonality 
with other fly-by-wire systems . The F-8 fly-by-wire system was unique in that 
it consisted of a simplex digital primary system , a triplex analog backup system , 
and no mechanical reversion capability. However, in this unique system were 
several features that will be relevant to the systems that will be required to achieve 
the advantages that active control offers . These features were , basically , dissimi- 
lar redundancy, single string software, and the experience associated with the 
digital system design. 


Dissimilar Redundancy 


The F-8 fly-by- wire system experience with two dissimilar systems provides 
information applicable to future systems which are likely to have dissimilar 
redundancy. Most of the problems were concerned with the synchronization of the 
two systems . Transfers from one system to another were handled differently , but 
the goal was to minimize transients caused by the transfer . In each instance, the 
system in control was tracked by the other system so that transients would be 
minimized. However, the primary system tracked the backup system by estimating 
the surface command of the backup system based on the pilot's control commands 
and trim inputs only. In transfers from the primary system to the backup system, 
the backup system tracked the output of the primary system . Although this 
eliminated the need to reconstruct the primary system signal propagation in the 
backup system , it did open the possibility for unusual initialization conditions when 
the transfer occurred during an abrupt maneuver . Another factor was that a 
transfer from the primary system to the backup system could have been initiated 
automatically as a result of a failure , thus the failure analysis had to consider all 
possible failures that could have resulted in a transfer . The timing of this transfer 
was critical in some instances when it could have coupled with the pilot's normal 
response to cause unacceptable conditions . 

Some aspects of the dissimilar redundant system gave insight into redundancy 
management problems which may be expected in the future. The backup system 
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mechanized the trim function using a digital integrator to reduce drift. Because of 
differences in the sampling mechanisms between the two systems , large errors 
between the two trim signals were noted after extended flight with the backup 
system in control in which numerous trim inputs were made. Figure 15 illustrates 
the two sampling mechanisms . The primary system sampled trim commands every 
90 milliseconds. If trim was being commanded at the time of the sample, the trim 
value was updated in the software . The backup control system did not update its 
digital trim integrator until a capacitor was charged up to a prescribed threshold . 
Although the capacitor began charging the instant the trim button was pushed , 
approximately 175 milliseconds were required before the first update of trim. As a 
result of these two sampling mechanisms, trim inputs of less than 175 milliseconds, 
but greater than 90 milliseconds, caused the primary system, but not the backup 
system , to update trim . To correct the problem , there would have had to be either 
some exchange of actual trim value information between the two systems or some 
form of verification that one system received the trim command before the other 
system updated the trim value . Each of these possible solutions would have required 
additional connections between the two systems , which would have been undesirable 
because they would have created new failure possibilities. For this particular 
research application, a procedural change in conjunction with close monitoring of 
telemetered data in the control room made modification of the system unnecessary . 


Single String Software 

Because a simplex digital system can have only a single program in control at 
one time , it can be described as a system with single string software . However , 
redundant digital systems with the same program in each computer also effectively 
have single string software. The experiences with the F-8 digital system software 
are closely related, then, to the multichannel digital systems expected in future 
civil transports . Generic software failures would have equivalent effects on any 
system with single string software, regardless of the system’s redundancy. The 
software controls described in reference 2 suggest that careful verification will 
always be necessary , but that the confidence necessary for man-rating the software 
can be established . 

Another factor that emphasized the importance of man-rated software was that 
the single string software had full-authority control over the control surfaces; thus 
it was obviously flight critical . Digital systems will be called on to perform more 
and more flight-critical functions and, on the basis of our experience, can be 
depended on to perform with high integrity . 

Removal of all mechanical reversion capability before the first flight had a 
significant effect on the entire design and verification process. It forced an 
approach that would establish complete confidence in the system on the basis of 
simulation alone . If the alternate approach had been taken , that of retaining a 
mechanical link , the most probable flight-test procedure would have been to fly to 
a safe altitude using the mechanical system and then engage the fly-by-wire system . 
After confidence was gained at altitude, the more critical flight safety functions, 
such as takeoff and landing , would have been encompassed gradually . 
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Design Experience 


On the basis of the F-8 digital fly-by-wire design experience, several recom- 
mendations can be made regarding the design of digital control systems for future 
civil transports . Many of these recommendations correspond simply to good design 
practice. Analyzing closed-loop performance using standard sampled-data analysis 
techniques such as z-plane root locus can be relied on to give good agreement with 
more complete simulations. Several forms of simulation and analysis should be 
used to build confidence in the system before the first flight . A simulation that 
includes as much actual hardware as possible is important in correctly assessing 
system performance. The interface with the pilot is particularly important. 


CONCLUDING REMARKS 


The feasibility of a digital fly-by-wire system was assessed by replacing the 
mechanical flight control system of an F-8C airplane with a digital primary and an 
analog backup fly-by-wire system. The design and verification procedures which 
will be necessary if flight-critical active control is to be used in future aircraft 
were established and successfully applied as part of the flight program . Careful 
application of standard sampled-data design methods and systematic verification of 
control system hardware and software using complete simulations resulted in a 
digital fly-by-wire system with extremely high integrity. The successful use of 
single string software in a full-authority flight control system demonstrated the 
high level of confidence which can be placed in digital flight control . 

The experience with the F-8 digital fly-by-wire system pointed up several 
factors that will be important in the successful design of future full-time , flight- 
critical digital control systems: 

(1) Batch process all-digital simulation was extremely helpful in tracing 
internal computer variables and in providing visibility to system response during 
mode changes . 

(2) A complete piloted simulation with actual flight control system hardware 
provided important results relative to the pilot/stick interface that had not been 
obtained in earlier simulations which did not include the actual control stick . 

(3) The largest portion of the design and verification effort was devoted to 
logic functions, such as mode transfers , and the effects of failures. 

(4) Software changes made late in the design to correct hardware-related 
problems had a negligible effect on the program schedule . 

A major aspect of the F-8 digital fly-by-wire system which will have application 
to future systems was its dissimilar redundancy . Failure isolation between the 
primary and the backup systems was achieved as desired , although some problems 
were encountered with intersystem synchronization . 
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Figure 1. F-8 digital fly-by -wire airplane 


E-24823 





(b) Yaw-axis damper . 


Figure 2. Standard F-8C roll and yaw stability augmentation systems. 
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Figure 3 . F-8C iron bird simulator . 
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Figure 4. F-8 digital fly-by-wire control system components. 
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Figure 5 , Location of fly -by-wire control system in 
F-8C airplane . 


Figure 6 . Mode and power panel 
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Figure 7 . F-8 digital fly -by-wire system mechanization. 
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Figure 8 . Digital system failure detection and reporting system . 
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Figure 9 . Direct modes for pitch , roll , and yaw axes . 
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Figure 11. Yaw stability augmentation system. 
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Figure 12 . Pitch command augmentation system . 
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Figure 13 . Pitch stability augmentation system mode as a sampled-data system . 
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Figure 14. Duty cyele variation during roll step maneuver . 


131 


Primary 

Backup 



button 


Time 


Figure 15. Trim sampling mechanisms of the primary and backup systems. 
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